From 0524d84c8958a0c7c8b86c4d7ca1b5992e82c4ff Mon Sep 17 00:00:00 2001
From: CarterPerez-dev <cartertechsolution@gmail.com>
Date: Thu, 14 May 2026 00:32:07 -0400
Subject: [PATCH] chore(canary): scope gosec G101/G107/G704 to outbound HTTP
 packages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes deferred Phase-9 item 4. Phase 9's rollup added G107 + G704 to
the global gosec.excludes as a stop-gap so the Turnstile siteverify
call wouldn't flag SSRF taint. With Phase 10 introducing webhook
sender that takes user-supplied URLs (validated at the call site via
webhook.validateURL before the request is built), the global excludes
hide the very kind of issue we want flagged anywhere new outbound HTTP
lands.

- gosec.excludes: drop G107 + G704 globally; keep only G104 + G706
  (the codebase-wide errcheck/subprocess policies).
- exclusions.rules path-scope G107|G704 to:
  * internal/notify/telegram/sender.go (operator-config bot URL)
  * internal/notify/webhook/sender.go (user URL with validateURL gate)
  * internal/turnstile/verifier.go (operator-config siteverify URL)
- exclusions.rules path-scope G101 to internal/config/config.go where
  the env-var-name map (WEBHOOK_HMAC_SECRET, TURNSTILE_SECRET_KEY,
  OPERATOR_TOKEN, etc.) trips the hardcoded-credentials regex on
  literal env var names — false positives, not actual secrets.

Any new client.Do(req) outside these three packages will surface
G107 at the call site and force the author to add URL validation.
---
 .../backend/.golangci.yml                      | 18 ++++++++++++++++--
 1 file changed, 16 insertions(+), 2 deletions(-)

diff --git a/PROJECTS/beginner/canary-token-generator/backend/.golangci.yml b/PROJECTS/beginner/canary-token-generator/backend/.golangci.yml
index d91996ee..b1e1ef48 100644
--- a/PROJECTS/beginner/canary-token-generator/backend/.golangci.yml
+++ b/PROJECTS/beginner/canary-token-generator/backend/.golangci.yml
@@ -73,8 +73,6 @@ linters:
       excludes:
         - G104
         - G706
-        - G107
-        - G704
 
     sloglint:
       no-mixed-args: true
@@ -91,6 +89,22 @@ linters:
           - funlen
           - dupl
           - goconst
+      - path: internal/notify/telegram/sender\.go
+        linters:
+          - gosec
+        text: "G107|G704"
+      - path: internal/notify/webhook/sender\.go
+        linters:
+          - gosec
+        text: "G107|G704"
+      - path: internal/turnstile/verifier\.go
+        linters:
+          - gosec
+        text: "G107|G704"
+      - path: internal/config/config\.go
+        linters:
+          - gosec
+        text: "G101"
 
 issues:
   max-same-issues: 50